Slashdot Mirror
NSA Takes On West Point In Security Exercise
Wired is running a story about a recent security exercise in which the NSA attacked networks set up by various US military academies. The Army's network scored the highest, put together using Linux and FreeBSD by cadets at West Point. Quoting:
"Even with a solid network design and passable software choices, there was an element of intuitiveness required to defend against the NSA, especially once it became clear the agency was using minor, and perhaps somewhat obvious, attacks to screen for sneakier, more serious ones. 'One of the challenges was when they see a scan, deciding if this is it, or if it's a cover,' says [instructor Eric] Dean. Spotting 'cover' attacks meant thinking like the NSA -- something Dean says the cadets did quite well. 'I was surprised at their creativity.' Legal limitations were a surprising obstacle to a realistic exercise. Ideally, the teams would be allowed to attack other schools' networks while also defending their own. But only the NSA, with its arsenal of waivers, loopholes, special authorizations (and heaven knows what else) is allowed to take down a U.S. network."
No, the NSA IS NOT part of the DOD. DOD is Department of Defense. There are 3 to 4 branches, depending on how you count: Army, Navy(Marines), Air Force. Yes, technically "The Marines" are part of the Navy.
Over-the-top Response Guy! Giving "Over-the-Top Responses" since 1970.
This isn't really an official extension of West Point, but rather a club at West Point known as SIGSAC.
The club's members every year get a chance to visit the NSA and see some rather interesting stuff, and so has a rather good relationship with the NSA in general.
The club itself operates out of West Point but has a network connection that isn't attached to West Point's network. It has actually participated in contests in the past as well with other schools/groups, so unless something's changed in the past couple years, that part of the summary is incorrect. If I had to wager a guess I'd say the focus of the group is just being directed purely at defensive measures, rather than actual attacks.
Frankly, I was underwhelmed by the whole story. It was pretty clear the journo doesn't have a clue what was going on. Wired should be able to do better than that.
"I've got more toys than Teruhisa Kitahara."
According to wikipedia, "The National Security Agency/Central Security Service (NSA/CSS) is a cryptologic intelligence agency of the United States government, administered under the U.S. Department of Defense. " and "The Department includes the Army, Navy, Air Force, Marine Corps, as well as non-combat agencies such as the National Security Agency and the Defense Intelligence Agency."
Under Secretary of Defense for Intelligence
* Defense Intelligence Agency
* Defense Security Service
* Counterintelligence Field Activity
* National Geospatial-Intelligence Agency
* National Reconnaissance Office
* National Security Agency
I was actually part of the exercise, and I would agree that the article is very vague. The main purpose of the exercise was to help cadets learn best security practices of building a network. There were required services we had to run, such as exchange, a web server, DNS, active directory, and a jabber messaging server. The rootkit they speak of was on the box because the other part of the exercise was trying to secure untrusted computers. They riddled two Windows VMs and one Linux VM with as much stuff as they could, and the told us to secure them. Naturally we missed some things, which allowed the callback to go out.
As for the 'custom tools', I have no idea what they are talking about. We used native Windows logging and a few open source programs to pull logs to a log server, but that was about it for extra programs. I would agree that the article was written for the non-technical person, but those are the kinda of questions they were asking us when the reporter was here.
Read up on the "Millenium Challenge '02" war games. :-)
Opposing Force Commander, Gen. Paul van Ripen won.
He was not invited back
Cadets do not learn, they just get to press the "refloat" icon.
http://www.nytimes.com/2008/01/12/washington/12navy.html?ex=1357794000&en=a4dbb42d5ad2a700&ei=5088&partner=rssnyt&emc=rss
"The sheer numbers involved overloaded their ability, both mentally and electronically, to handle the attack,.. "
Domestic spying is now "Benign Information Gathering"
IF Asked AND IF Unclassified, the agency/party MAY provide a copy of the ENDEX.
Contact the Acadamies, NSA, even the Departments of Defense, Army, Air Force, Navy.
ENDEX's have event logs, referee notes, exercise build and teardown plans....
The only thing new in this world is the history that you don't know.[Harry Truman]
The tools we used were Nagios for service verification on an external computer (just to make sure we saw what the scorers saw, so we didn't lose points due to their slow network) and one box running Snort through a one way cable. We weren't allowed to let Snort block things, but it let us know who was doing what, allowing us to send up a request to the graders to block the IP. As for checking the untrusted boxes, we were able to run whatever we wanted on them. The root kit that we missed we simply didn't find in the mess of everything else.
It all came down to the scenario. Built into the game was a notional 'cost' for different network items, making certain items prohibitively expensive. It mainly came down to the semantics of the rules, but the costs were going to be looked at for next year. The overall effect was eliminating the use of some best practices simply because of cost.
...the right of the people to keep and bear arms, shall not be infringed.